Skip to content

Commit 423d56b

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4282 from camilamacedo86/fix-ca-injection-conversion-webhooks
🐛 (kustomize/v2, go/v4): Fix ca injection for conversion webhooks
2 parents f3e8d3a + 7d4c91d commit 423d56b

File tree

27 files changed

+320
-160
lines changed

27 files changed

+320
-160
lines changed

‎.github/workflows/test-e2e-samples.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@ jobs:
4141
run: |
4242
KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml"
4343
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
44-
sed -i '55,182s/^#//' $KUSTOMIZATION_FILE_PATH
44+
# Uncomment all cert-manager injections
45+
sed -i '55,168s/^#//' $KUSTOMIZATION_FILE_PATH
46+
sed -i '170,185s/^#//' $KUSTOMIZATION_FILE_PATH
4547
cd testdata/project-v4/
4648
go mod tidy
4749
@@ -81,9 +83,12 @@ jobs:
8183
KUSTOMIZATION_FILE_PATH="testdata/project-v4-with-plugins/config/default/kustomization.yaml"
8284
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
8385
# Uncomment only ValidatingWebhookConfiguration
84-
# from cert-manager replaces
86+
# from cert-manager replaces; we are leaving defaulting uncommented
87+
# since this sample has no defaulting webhooks
8588
sed -i '55,121s/^#//' $KUSTOMIZATION_FILE_PATH
86-
sed -i '153,182s/^#//' $KUSTOMIZATION_FILE_PATH
89+
# Uncomment only --conversion webhooks CA injection
90+
sed -i '153,168s/^#//' $KUSTOMIZATION_FILE_PATH
91+
sed -i '170,185s/^#//' $KUSTOMIZATION_FILE_PATH
8792
cd testdata/project-v4-with-plugins/
8893
go mod tidy
8994
@@ -122,7 +127,9 @@ jobs:
122127
run: |
123128
KUSTOMIZATION_FILE_PATH="testdata/project-v4-multigroup/config/default/kustomization.yaml"
124129
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
125-
sed -i '55,182s/^#//' $KUSTOMIZATION_FILE_PATH
130+
# Uncomment all cert-manager injections
131+
sed -i '55,168s/^#//' $KUSTOMIZATION_FILE_PATH
132+
sed -i '170,185s/^#//' $KUSTOMIZATION_FILE_PATH
126133
cd testdata/project-v4-multigroup
127134
go mod tidy
128135

‎docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ patches:
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
1915
#configurations:

‎docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -156,27 +156,13 @@ replacements:
156156
# version: v1
157157
# name: serving-cert # This name should match the one in certificate.yaml
158158
# fieldPath: .metadata.namespace # Namespace of the certificate CR
159-
# targets:
160-
# - select:
161-
# kind: CustomResourceDefinition
162-
# fieldPaths:
163-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
164-
# options:
165-
# delimiter: '/'
166-
# index: 0
167-
# create: true
159+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
160+
# +kubebuilder:scaffold:crdkustomizecainjectionns
168161
# - source:
169162
# kind: Certificate
170163
# group: cert-manager.io
171164
# version: v1
172165
# name: serving-cert # This name should match the one in certificate.yaml
173166
# fieldPath: .metadata.name
174-
# targets:
175-
# - select:
176-
# kind: CustomResourceDefinition
177-
# fieldPaths:
178-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
179-
# options:
180-
# delimiter: '/'
181-
# index: 1
182-
# create: true
167+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
168+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ patches:
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
1915
#configurations:

‎docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -156,27 +156,13 @@ patches:
156156
# version: v1
157157
# name: serving-cert # This name should match the one in certificate.yaml
158158
# fieldPath: .metadata.namespace # Namespace of the certificate CR
159-
# targets:
160-
# - select:
161-
# kind: CustomResourceDefinition
162-
# fieldPaths:
163-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
164-
# options:
165-
# delimiter: '/'
166-
# index: 0
167-
# create: true
159+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
160+
# +kubebuilder:scaffold:crdkustomizecainjectionns
168161
# - source:
169162
# kind: Certificate
170163
# group: cert-manager.io
171164
# version: v1
172165
# name: serving-cert # This name should match the one in certificate.yaml
173166
# fieldPath: .metadata.name
174-
# targets:
175-
# - select:
176-
# kind: CustomResourceDefinition
177-
# fieldPaths:
178-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
179-
# options:
180-
# delimiter: '/'
181-
# index: 1
182-
# create: true
167+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
168+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,6 @@ patches:
1111
- path: patches/webhook_in_cronjobs.yaml
1212
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1313

14-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
15-
# patches here are for enabling the CA injection for each CRD
16-
#- path: patches/cainjection_in_cronjobs.yaml
17-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
18-
1914
# [WEBHOOK] To enable webhook, uncomment the following section
2015
# the following config is for teaching kustomize how to do kustomization for CRDs.
2116
configurations:

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,27 +156,31 @@ replacements:
156156
version: v1
157157
name: serving-cert # This name should match the one in certificate.yaml
158158
fieldPath: .metadata.namespace # Namespace of the certificate CR
159-
targets:
159+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
160160
- select:
161161
kind: CustomResourceDefinition
162+
name: cronjobs.batch.tutorial.kubebuilder.io
162163
fieldPaths:
163164
- .metadata.annotations.[cert-manager.io/inject-ca-from]
164165
options:
165166
delimiter: '/'
166167
index: 0
167168
create: true
169+
# +kubebuilder:scaffold:crdkustomizecainjectionns
168170
- source:
169171
kind: Certificate
170172
group: cert-manager.io
171173
version: v1
172174
name: serving-cert # This name should match the one in certificate.yaml
173175
fieldPath: .metadata.name
174-
targets:
176+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
175177
- select:
176178
kind: CustomResourceDefinition
179+
name: cronjobs.batch.tutorial.kubebuilder.io
177180
fieldPaths:
178181
- .metadata.annotations.[cert-manager.io/inject-ca-from]
179182
options:
180183
delimiter: '/'
181184
index: 1
182185
create: true
186+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/reference/markers/scaffold.md‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,67 @@ properly registered with the manager, so that the controller can reconcile the r
103103
| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. |
104104
| `+kubebuilder:scaffold:crdkustomizeresource`| `config/crd` | Marks where CRD custom resource patches are added. |
105105
| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. |
106-
| `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhook. |
106+
| `+kubebuilder:scaffold:crdkustomizecainjectionns` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
107+
| `+kubebuilder:scaffold:crdkustomizecainjectioname` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
108+
| **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhooks. Replaced by `+kubebuilder:scaffold:crdkustomizecainjectionns` and `+kubebuilder:scaffold:crdkustomizecainjectioname` |
107109
| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. |
108110
| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. |
109111

112+
<aside class="note warning">
113+
<h1> **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` </h1>
114+
115+
If you find this marker in your code please:
116+
117+
1. **Remove the CERTMANAGER Section from `config/crd/kustomization.yaml`:**
118+
119+
Delete the `CERTMANAGER` section to prevent unintended CA injection patches for CRDs. Ensure the following lines are removed or commented out:
120+
121+
```yaml
122+
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
123+
# patches here are for enabling the CA injection for each CRD
124+
#- path: patches/cainjection_in_firstmates.yaml
125+
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
126+
```
127+
128+
2. **Ensure CA Injection Configuration in `config/default/kustomization.yaml`:**
129+
130+
Under the `[CERTMANAGER]` replacement in `config/default/kustomization.yaml`, add the following code for proper CA injection generation:
131+
132+
**NOTE:** You must ensure that the code contains the following target markers:
133+
- `+kubebuilder:scaffold:crdkustomizecainjectionns`
134+
- `+kubebuilder:scaffold:crdkustomizecainjectioname`
135+
136+
```yaml
137+
# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
138+
# kind: Certificate
139+
# group: cert-manager.io
140+
# version: v1
141+
# name: serving-cert # This name should match the one in certificate.yaml
142+
# fieldPath: .metadata.namespace # Namespace of the certificate CR
143+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
144+
# +kubebuilder:scaffold:crdkustomizecainjectionns
145+
# - source:
146+
# kind: Certificate
147+
# group: cert-manager.io
148+
# version: v1
149+
# name: serving-cert # This name should match the one in certificate.yaml
150+
# fieldPath: .metadata.name
151+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
152+
# +kubebuilder:scaffold:crdkustomizecainjectioname
153+
```
154+
155+
3. **Ensure Only Conversion Webhook Patches in `config/crd/patches`:**
156+
157+
The `config/crd/patches` directory and the corresponding entries in `config/crd/kustomization.yaml` should only contain files for conversion webhooks. Previously, a bug caused the patch file to be generated for any webhook, but only patches for webhooks scaffolded with the `--conversion` option should be included.
158+
159+
For further guidance, you can refer to examples in the `testdata/` directory in the Kubebuilder repository.
160+
161+
> **Alternatively**: You can use the [`alpha generate`](./../rescaffold.md) command to re-generate the project from scratch
162+
> using the latest release available. Afterward, you can re-add only your code implementation on top to ensure your project
163+
> includes all the latest bug fixes and enhancements.
164+
165+
</aside>
166+
110167
<aside class="note">
111168
<h1>Creating Your Own Markers</h1>
112169

‎hack/docs/internal/multiversion-tutorial/generate_multiversion.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,13 @@ func (sp *Sample) updateDefaultKustomize() {
279279
// Enable CA for Conversion Webhook
280280
err := pluginutil.UncommentCode(
281281
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
282-
caConversionCRDDefaultKustomize, `#`)
282+
caInjectionNamespace, `#`)
283+
hackutils.CheckError("fixing default/kustomization", err)
284+
285+
// Enable CA for Conversion Webhook
286+
err = pluginutil.UncommentCode(
287+
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
288+
caInjectionCert, `#`)
283289
hackutils.CheckError("fixing default/kustomization", err)
284290
}
285291

0 commit comments

Comments
 (0)